The absolute most common issue with IoT devices is default passwords. So change all the passwords. Pick a unique, random password for every device and write it down on paper (paper is safe from remote attackers and hard drive failures). 12 random (i.e. computer-generated) lowercase letters represent a good compromise between security and being hard to type. Each device should have a different password so that breaking one doesn't let the attacker break all of them. Enter the passwords in a password manager and use that password manager in the computers you use to control the devices.
If the device has different authorization channels, for example an administration password and a day-to-day usage password, use different passwords for both and only record the administration password on selected devices.
The second generic security measure is to ensure that all your devices are behind a firewall or at least a NAT device. A typical home router is sufficient, but you should turn off UPnP which can allow inadvertent back channels from the outside. The goal is to ensures that there's no direct way to connect from the Internet to the device. Connections should always go through a gateway that itself requires authentication to cross, and that you keep patched with any security updates.
You should also apply security updates on all the devices… if they exist at all, which can be a problem.